RNS-CKKS-based Convolutions. RNS-CKKS-based convolutions between an encrypted input tensor (\(A\) ) and multiple plaintext weight filters (\(F\) s) are shown in Figure REF (a). The convolution result can be denoted as \(b_{x,y} = \sum _{i,j}{a_{x+i,y+j}}\cdot f_{i,j}\) . We assume the input \(A\)  has \(C\)  channels, a height of \(H\) , and a width of \(W\) . As Figure REF (b) shows, the input tensor can be encrypted into \(C\)  ciphertexts, each of which packs \(H\times W\)  input elements [1]}. This is the \(HW\)  batching scheme. Or to fully utilize the slots in a ciphertext, \(C\times H\times W\)  input elements can be packed into \(\lceil \frac{2\times C\times H\times W}{N}\rceil \)  ciphertexts [1]}, where \(\lceil \rceil \)  represents a rounding up operation. This is the \(CHW\)  batching scheme. To compute \(a_{x+i,y+j}\cdot f_{i,j}\) , element-wise HE multiplications happen between the input tensor and each weight filter. A HE rotation operation \(rot(A, s)\)  is required to align the corresponding data to support the HE accumulation, where \(s\)  represents the stride distance. At last, a plaintext mask is used to remove the irrelevant slots \(\#\#\) .
